chore(cv2-build): record guest release cr7727-0a0d28c67858 — first main-lineage x264 image #49

Merged

triform-admin merged 3 commits from chore/guest-release-0a0d28c into main 2026-07-30 14:07:57 +00:00

Conversation 1 Commits 3 Files changed 1 +5 -10

triform-admin commented 2026-07-30 06:52:04 +00:00

Owner

Copy link

Provenance record for the C1/C2 promotion. The seed record's known_gap block is removed exactly per its own clears_when: this image was built from a main-descendant SHA (0a0d28c = #48 merged; ancestry verified). First image whose unit tests ran+passed against real x264 (both STEP-7 suites SUCCESS) and first with HAS_X264 since 2026-05-05.

sw-pool is already advanced to this tag (approved promotion). The tf-multiverse auto-bump follows this record.

🤖 Generated with Claude Code

Provenance record for the C1/C2 promotion. The seed record's `known_gap` block is removed exactly per its own `clears_when`: this image was built from a **main-descendant SHA** (0a0d28c = #48 merged; ancestry verified). First image whose unit tests ran+passed against real x264 (both STEP-7 suites SUCCESS) and first with HAS_X264 since 2026-05-05. sw-pool is already advanced to this tag (approved promotion). The tf-multiverse auto-bump follows this record. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

triform-admin added 1 commit 2026-07-30 06:52:04 +00:00

chore(cv2-build): record guest release cr7727-0a0d28c67858 — first main-lineage, x264-profile image ... 0d349efd8c

Written per chromeless-kaniko-push.sh's ACTION REQUIRED (the script's
log-follow lost the pod during ContainerCreating, so the record write
step never ran locally; values taken from the push job's own output:
digest sha256:6160a151..., pushed 06:43Z).

The seed record's known_gap block is REMOVED — exactly per its own
clears_when: this image was built by chromeless-build.sh from a
main-descendant SHA (0a0d28c = PR #48, merged; verified
merge-base --is-ancestor origin/main). Production guest provenance is
on main for the first time.

This is also the first image whose unit tests ran and passed against
a real x264-profile binary (STEP 7: both suites SUCCESS), and the
first with HAS_X264 actually defined since 2026-05-05 (#46).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

triform-admin commented 2026-07-30 13:53:10 +00:00

Author

Owner

Copy link

⚠️ Hold this until #50 merges — the recorded image cannot boot outside firecracker.

This records cr7727-0a0d28c67858, built from 0a0d28c. That commit predates e27423f ("chromium never starts in a plain container — /dev/console sink is firecracker-only"), and I verified the tree at that SHA:

$ git show 0a0d28c:infra/lifecycle/entrypoint.sh | grep -c dev/console
0

So the image this record points at has no console fallback: [program:chromium]'s stderr_logfile=/dev/console has no sink in a k8s pod or plain docker container, supervisord fails the program with spawnerr: unknown error making dispatchers for 'chromium': EACCES, and it retries forever. It works only under firecracker, which is where the gap hid for so long.

Recording it as the guest release would enshrine an image that fails for every container-runtime consumer — including this repo's own smoke/e2e jobs, which now really run.

Suggested sequencing:

1. Merge #50 first — it carries e27423f + f9e46a1 (the console fix and its /run/supervisor follow-up) plus the CI fixes that made all of this visible.
2. Re-point this record at the image that is actually verified good:

{
  "commit": "f9e46a1434b56d02bcf47668133b6fdb145dbfa0",
  "image":  "registry.triform.cloud/chromeless/chromeless:cr7727-f9e46a1434b5",
  "digest": "sha256:06766d9a56d5971b26a197a485b35d0903aadc69d9e6537098f7317007e7bcd4"
}

That tag is the one now serving sw-pool and CHROMELESS_IMAGE, and it is verified twice: all four supervisord programs reach RUNNING with 0 restarts in a bare k8s pod, and tests/smoke/container-boot.sh passes end-to-end against it (real navigation, 17121-byte valid PNG).

The commit field must stay main-ancestry, so step 2 has to follow step 1.

⚠️ **Hold this until #50 merges — the recorded image cannot boot outside firecracker.** This records `cr7727-0a0d28c67858`, built from `0a0d28c`. That commit predates `e27423f` ("chromium never starts in a plain container — /dev/console sink is firecracker-only"), and I verified the tree at that SHA: ``` $ git show 0a0d28c:infra/lifecycle/entrypoint.sh | grep -c dev/console 0 ``` So the image this record points at has no console fallback: `[program:chromium]`'s `stderr_logfile=/dev/console` has no sink in a k8s pod or plain docker container, supervisord fails the program with `spawnerr: unknown error making dispatchers for 'chromium': EACCES`, and it retries forever. It works only under firecracker, which is where the gap hid for so long. Recording it as *the* guest release would enshrine an image that fails for every container-runtime consumer — including this repo's own smoke/e2e jobs, which now really run. **Suggested sequencing:** 1. Merge #50 first — it carries `e27423f` + `f9e46a1` (the console fix and its `/run/supervisor` follow-up) plus the CI fixes that made all of this visible. 2. Re-point this record at the image that is actually verified good: ```json { "commit": "f9e46a1434b56d02bcf47668133b6fdb145dbfa0", "image": "registry.triform.cloud/chromeless/chromeless:cr7727-f9e46a1434b5", "digest": "sha256:06766d9a56d5971b26a197a485b35d0903aadc69d9e6537098f7317007e7bcd4" } ``` That tag is the one now serving `sw-pool` and `CHROMELESS_IMAGE`, and it is verified twice: all four supervisord programs reach RUNNING with 0 restarts in a bare k8s pod, and `tests/smoke/container-boot.sh` passes end-to-end against it (real navigation, 17121-byte valid PNG). The `commit` field must stay main-ancestry, so step 2 has to follow step 1.

triform-admin added 2 commits 2026-07-30 14:01:05 +00:00

Merge main (PR #50: real-image CI) before re-pointing the release record 72953904be

chore(cv2-build): re-point the release record at cr7727-f9e46a1434b5 ... fd80492d23

The recorded image was cr7727-0a0d28c67858, built from 0a0d28c — which
predates e27423f, the fix for "chromium never starts in a plain container".
Verified on the tree at that SHA:

  $ git show 0a0d28c:infra/lifecycle/entrypoint.sh | grep -c dev/console
  0

So that image has no console fallback: [program:chromium]'s
stderr_logfile=/dev/console has no sink outside a microVM, supervisord fails
the program with `spawnerr: unknown error making dispatchers for 'chromium':
EACCES`, and retries forever. It boots ONLY under firecracker. Recording it as
the guest release would enshrine an image that fails for every
container-runtime consumer — including this repo's own smoke and e2e jobs,
which now actually run.

cr7727-f9e46a1434b5 carries e27423f plus its follow-up f9e46a1 (the fallback
must write /run/supervisor, not root-owned /run), and is verified twice:

  * bare k8s pod: all four supervisord programs reach RUNNING with 0
    restarts; DevTools /json/version answers.
  * tests/smoke/container-boot.sh end-to-end: real navigation to
    example.com, 17121-byte valid PNG, "container-boot: PASS".

It is also the tag now serving sw-pool and the CHROMELESS_IMAGE CI variable,
so the record, the deployed pool and CI all name one image.

built_at is the image config's own `created` timestamp read back from the
registry, not a hand-typed guess.

main is merged in first because the `commit` field must be main-ancestry, and
f9e46a1 only reached main via PR #50.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

triform-admin merged commit 991bc9be9f into main 2026-07-30 14:07:57 +00:00

triform-admin referenced this pull request from a commit 2026-07-30 14:07:58 +00:00

Merge pull request 'chore(cv2-build): record guest release cr7727-f9e46a1434b5' (#49) from chore/guest-release-0a0d28c into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

triform/chromeless!49

No description provided.